Cisco CyberOps Associate Module 24 -25 Exam

Which 3 items would be found in an ACL rule?

Which is a name resolution protocol can be used by malware to communicate with command-and-control (CnC) servers?

Which function is provided by the Sguil application?

The Network Time Protocol (NTP) uses a hierarchy of time sources to provide a consistent time to network devices.

What type of data is created by analyzing other forms of network data.

What is a feature of the tcpdump tool?

Which is used to share a distributed database or ledger.

Which statement describes statistical data in a network security monitoring processes?

Which is a Cisco firewall appliance?

Which SIEM function links logs and events from different systems or applications?

What would indicate that a system has a problem associated with NTP.

What is Tor?

What can be determined from the output of the traffic flow shown? (hint source port 53)

Which method is used by some malware to transfer files from infected hosts to a threat actor host?

What should you do if a scan utility finds lsass.exe running in the Program Files directory?

Which technique is necessary to ensure a private transfer of data using a VPN?

Which Windows logs contain events events related to the operation of drivers, processes, and hardware?

Which statement describes a Cisco Web Security Appliance (WSA)?

Session data is a record of a conversation between two network endpoints.

What is the normal function of IMAP?

Which type of attack is carried out against a network to find IP addresses, protocols, and ports?

Which approach prevents exploits that target older syslog systems?

Which is a normal function DNS?

Which is a command-line packet analyzer tool?

Which statement describes session data in security logs?

Confidential and secure transfers of data with VPNs require data encryption.

Which Windows logs contain events from various applications?

Why does HTTPS make network security monitoring more complex?

ACLs use rules to filter incoming and outgoing traffic.

Which ICMP message type should be allowed outbound?

Syslog is a daemon or service run on a server that accepts messages sent by network devices.

What is the difference between HTTP and HTTPS

Which SIEM function reduces the volume of event data by consolidating duplicate event records?

Many organizations have less stringent policies to protect against DNS-based threats

What does Bitcoin share?

Which SIEM function maps log messages from different systems into a common data model?

On Windows PCs, security logging and policy enforcement are carried out by Local Security Authority Subsystem Service.

Which two tools have a GUI interface to view and analyze full packet captures? (Choose two.)

Syslog-ng is the next generation of syslog containing improvements to prevent some exploits.

In network monitoring, what does NBA stand for?

What would you use to review server logs generated by network devices?

The header in a syslog message is missing a time stamp. What might be wrong?

Pick 2 application layer protocols that manage client web browser and web server exchanges?

The echo ICMP echo packet should not be allowed inbound on your home router.

Where should Windows normally store the lsass.exe file?

Two network monitoring approaches that use advanced analytic techniques to analyze network telemetry data? (Choose two)

In network monitoring, what does NBAD stand for?

Which technique would a threat actor use to disguise timetraces of an ongoing exploit?

How can IMAP be a security threat?

What does it indicate if the timestamp in the HEADER section of a syslog message is preceded by a period or asterisk?

Which Windows tool can be used to review host logs?

Which logs contain information about the installation of software, including Windows updates?

Which appliance can be used to filter traffic contents to report and deny traffic based on the web server reputation?

Which logs containevents related to logon attempts and operations related to file or object management and access?

Which protocol is exploited by cybercriminals creating malicious iFrames?

In a Cisco AVC system, in which module is NetFlow deployed?

Which information can be provided by the Cisco NetFlow utility?

What do packet filtering ACLs use to filter incoming and outgoing traffic?

What does Windows use for security logging and policy enforcement?

Which two technologies are primarily used on peer-to-peer networks? (Choose two.)

What does BitTorrent share?

The echo-reply should be allowed so that if an internal device pings an external device, the reply is allowed to return.

Snorby and Sguil can be used to read and search alert messages generated by NIDS/NIPS.

How does a web proxy device provide data loss prevention (DLP)?